The ca.crt and ca.key has configured as SSLCertificateFile and SSLCertificateKeyFile in above virtual host configuration.

If the CN (Common Name) of the back end server certificate is different
from the virtual host name, then you need to disable the
SSLProxyCheckPeerCN and SSLProxyCheckPeerName in the virtual host
configuration.

4.0 Create new key store for gateway nodes.

i) Generate new key store.

Make sure to enter the gw.wso2am as the first and last name , that value will be set as common name (CN).

Enter the key store password as wso2carbon , then you don't need to change the default key store configurations in API Manager.

iii) Open the api-manager.xml file of the manager nodes and configure the
<APIGateway> configuration.(ServerURL should point to proxy-3)

<APIGateway>
<!-- The environments to which an API will be published -->
<Environments>
<!-- Environments can be of different types. Allowed values are 'hybrid', 'production' and 'sandbox'.
An API deployed on a 'production' type gateway will only support production keys
An API deployed on a 'sandbox' type gateway will only support sandbox keys
An API deployed on a 'hybrid' type gateway will support both production and sandbox keys -->
<Environment type="hybrid" api-console="true">
<Name>Production and Sandbox</Name>
<Description> Description of environment</Description>
<!--
Server URL of the API gateway.
-->
<ServerURL>https://mgt.gw.wso2am/services/</ServerURL>
<!--
Admin username for the API gateway.
-->
<Username>${admin.username}</Username>
<!--
Admin password for the API gateway.
-->
<Password>${admin.password}</Password>
<!--
Endpoint URLs for the APIs hosted in this API gateway.
-->
<GatewayEndpoint>http://gw.wso2am,https://gw.wso2am</GatewayEndpoint>
</Environment>
</Environments>
</APIGateway>

11. Insall the proxy certificates to the client-truststore.jks file in gateway and manager nodes.

12. Configure gateway cluster.

i) Open the axis2.xml (repository\conf\axis2) file and enable clsutering.

i) Go to the bin directory and execute the startup script (wso2server.sh for Linux and wso2server.bat for windows) as bellow. (If you have alreay started the server ,then delete the repository\database directory before start the serevr - This is to create the mount configuration in local registry).
Eg: for Linux